Privacy policy

Nanatec Limited is a company incorporated in Kenya, with its office at Kasarani Mwiki Road, Nairobi 00100, Kenya. For personal data collected through this website and through our client engagements, we act as the data controller as defined in the Data Protection Act, 2019.

You can reach us about anything in this policy at:

• Email — privacy@nanatec.co.ke
• General enquiries — info@nanatec.co.ke
• Telephone — +254759530195
• Postal — Kasarani Mwiki Road, Nairobi 00100, Kenya

This policy covers personal data we collect through this website, through enquiry and quotation forms, and through the course of delivering work to our clients. Where we build and operate a platform on a client’s behalf, that client is normally the data controller for the data held in their system and we act as their data processor under a written agreement. This policy does not replace those agreements.

Data you give us

Name, email address, telephone number, company name and the content of your message when you submit the contact form, request a quotation, or start a conversation through the chat assistant on this site.

Engagement data

Contact and correspondence details for the people we work with at a client organisation, together with the project records needed to scope, deliver, invoice and support the work.

Technical data

Standard server request data — IP address, browser and device type, requested page, and timestamp — recorded by our hosting infrastructure for security and reliability purposes.

We do not operate advertising or behavioural tracking on this site, and we do not sell personal data.

Under section 30 of the Data Protection Act, 2019, we rely on the following lawful bases:

Consent

When you voluntarily submit an enquiry or quotation request so that we can respond to you.

Performance of a contract

When processing is necessary to scope, deliver, support or invoice work you have engaged us for.

Legal obligation

When we are required to retain records — for example accounting and tax records under Kenyan law.

Legitimate interest

To keep our infrastructure secure and available, and to keep a record of our business correspondence. We only rely on this where it does not override your rights.

We share personal data only with service providers who process it on our instructions under a written agreement, and only to the extent needed to run this website and respond to you.

Form delivery

EmailJS transmits the contents of the contact and quotation forms to our email inbox.

Chat assistant

Conversations started in the on-site chat assistant are handled by our own chatbot service operating on Nanatec-controlled infrastructure.

Hosting and infrastructure

Our hosting and infrastructure providers process technical request data in order to serve this site.

We may also disclose personal data where we are legally required to do so, or where it is necessary to establish, exercise or defend a legal claim.

Some of the service providers named above process data on infrastructure located outside Kenya. Where personal data is transferred out of the country, we do so on the conditions set out in sections 48 and 49 of the Data Protection Act, 2019 — meaning we satisfy ourselves that appropriate safeguards are in place, or that the transfer is necessary for the performance of a contract with you.

Where a client engagement requires data residency in Kenya, we will architect and host the platform accordingly, and record that requirement in the engagement agreement.

• Enquiry and quotation records — retained for as long as needed to respond and for a reasonable period afterwards for business-record purposes.
• Client engagement records — retained for the duration of the engagement and for the period required by Kenyan accounting and tax law.
• Technical request logs — retained on a short rolling window for security and reliability purposes.

When personal data is no longer required for the purpose it was collected for, we delete it or anonymise it.

Section 26 of the Data Protection Act, 2019 gives you the right to:

• Be informed of the use to which your personal data is put
• Access the personal data we hold about you
• Object to the processing of all or part of your personal data
• Have inaccurate or misleading personal data corrected
• Have personal data deleted or destroyed where we no longer have a lawful reason to keep it
• Request that your personal data be transferred to another data controller, where technically feasible

To exercise any of these rights, write to privacy@nanatec.co.ke. We will respond within the timelines set out in the Act. Exercising these rights is free of charge, and we will not treat you differently for doing so.

We apply the technical and organisational measures appropriate to the systems we build and operate:

• Encryption in transit for all traffic to this site and to the platforms we operate
• Role-based access control, with access granted on a least-privilege basis
• Audit logging on the systems where a decision or a transaction needs to be attributable
• Separation of production environments from development and testing environments
• Written processing terms with the service providers we rely on

If a personal data breach occurs that presents a real risk to the rights and freedoms of affected people, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and communicate with affected data subjects as required by the Act.

If you are not satisfied with how we have handled your personal data, contact us first at privacy@nanatec.co.ke so we can try to resolve it. You also have the right to lodge a complaint directly with the Office of the Data Protection Commissioner (ODPC), Kenya.

We update this policy when our processing practices change or when the law requires it. The date this version took effect is shown at the top of the page. Material changes will be reflected here before they take effect.